f857a2b99a4ebd63b0b07afa416f09d48bfdad964bea0f62e15b2f0756fa3c67

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 12.8MB
Sample260714-efjs5af13t
SHA256 f857a2b99a4ebd63b0b07afa416f09d48bfdad964bea0f62e15b2f0756fa3c67
MD5 5dcbb1125a348fde6e6190673893000c
SHA1 5c0493a86db68d353aa62c222a6a7d20d425c355
SHA512 8c92f9fa09cbd5f17b59c92f708277edba16dce8ea3c2092a81a37c6d6c8542430aec1317b888f512d42de2f66c2dfcd17a9c9e118dd28ebe03577c1299883b0
SSDEEP 98304:B4TS4TS4TS4TS4TS4TS4TS4T6OU/jIEeQfoR/IuOFVjUu54:BppppppphFIF0wum
TLSH
T13ED67C12B6ED016DF0F30B31EE39A266A935FCFE6E12D55E6549740E2672B00C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Custom signature

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024579-13.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe

Executes dropped EXE 34 IoCs

pid	Process
4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe
5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe
5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe
3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe
512	svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
3960	svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe
3452	svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
4256	svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe
4536	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
3980	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
2828	svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe
3120	svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe
4288	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
4644	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
4372	svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
2172	svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe
3968	svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe
2692	svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe
2044	svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe
4276	svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe
3288	svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe
3152	svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
1404	svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe
5324	svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe
5632	svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe
5972	svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe
5220	svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe
5612	svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABBABAACCBACACBBCBBBCBABABBACCBCCBBBAABCCCACBCBBACCBCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe"	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACBAAAABCCAAACBCABCCCBBCCBAABBCCBBBBBABCCACBBACAABABACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe"	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACAACCACCAABBBCCACCBBBBCCBBCCACBBABACAACBBCBCCBAACBACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe"	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe"	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBBACBAABAABABBBCBCBABCCAABABBABBABABBBBABABCACBBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe"	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe

Launches sc.exe 59 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1316	sc.exe
3500	sc.exe
2036	sc.exe
628	sc.exe
5544	sc.exe
1800	sc.exe
3160	sc.exe
1680	sc.exe
5192	sc.exe
3696	sc.exe
3376	sc.exe
2392	sc.exe
1700	sc.exe
3700	sc.exe
2064	sc.exe
436	sc.exe
3324	sc.exe
1380	sc.exe
5944	sc.exe
2780	sc.exe
2348	sc.exe
3936	sc.exe
3532	sc.exe
628	sc.exe
2136	sc.exe
4944	sc.exe
5060	sc.exe
5124	sc.exe
4792	sc.exe
4396	sc.exe
536	sc.exe
4512	sc.exe
804	sc.exe
5684	sc.exe
5856	sc.exe
512	sc.exe
3700	sc.exe
1768	sc.exe
2712	sc.exe
3756	sc.exe
60	sc.exe
176	sc.exe
5312	sc.exe
4864	sc.exe
1392	sc.exe
4612	sc.exe
5580	sc.exe
2660	sc.exe
2448	sc.exe
5240	sc.exe
4996	sc.exe
2988	sc.exe
3664	sc.exe
2008	sc.exe
5620	sc.exe
5488	sc.exe
4236	sc.exe
1016	sc.exe
3404	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1404	schtasks.exe
5168	schtasks.exe
2956	schtasks.exe
5092	schtasks.exe
4552	schtasks.exe
2408	schtasks.exe
3940	schtasks.exe
5412	schtasks.exe
4104	schtasks.exe
5068	schtasks.exe
4860	schtasks.exe
4456	schtasks.exe
2448	schtasks.exe
5472	schtasks.exe
1028	schtasks.exe
4292	schtasks.exe
4396	schtasks.exe
1552	schtasks.exe
2492	schtasks.exe
2448	schtasks.exe
4328	schtasks.exe
2920	schtasks.exe
5768	schtasks.exe
6136	schtasks.exe
4448	schtasks.exe
2780	schtasks.exe
4192	schtasks.exe
2064	schtasks.exe
968	schtasks.exe
4512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe
4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe
4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe
1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe
1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe
1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe
3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe
3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe
5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
512	svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
512	svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
3960	svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe
3960	svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe
3452	svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
3452	svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
4256	svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe
4256	svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe
3980	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
3980	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
4536	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
4536	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
2828	svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe
2828	svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe
3120	svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe
3120	svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe
4288	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
4288	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
4644	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
4644	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
3968	svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe
3968	svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe
4372	svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
4372	svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
2692	svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe
2692	svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe
2044	svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe
2044	svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe
3152	svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
3152	svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
5324	svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe
5324	svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe
1404	svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe
1404	svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe
4536	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
4536	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
Token: SeDebugPrivilege	1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
Token: SeDebugPrivilege	1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
Token: SeDebugPrivilege	5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
Token: SeDebugPrivilege	4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe
Token: SeDebugPrivilege	4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
Token: SeDebugPrivilege	1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe
Token: SeDebugPrivilege	1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe
Token: SeDebugPrivilege	3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe
Token: SeDebugPrivilege	5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
Token: SeDebugPrivilege	512	svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
Token: SeDebugPrivilege	3960	svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe
Token: SeDebugPrivilege	3452	svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
Token: SeDebugPrivilege	4256	svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe
Token: SeDebugPrivilege	3980	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
Token: SeDebugPrivilege	4536	svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
Token: SeDebugPrivilege	2828	svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe
Token: SeDebugPrivilege	3120	svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe
Token: SeDebugPrivilege	4288	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
Token: SeDebugPrivilege	4644	svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
Token: SeDebugPrivilege	3968	svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe
Token: SeDebugPrivilege	4372	svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
Token: SeDebugPrivilege	2692	svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe
Token: SeDebugPrivilege	2044	svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe
Token: SeDebugPrivilege	3152	svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
Token: SeDebugPrivilege	5324	svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe
Token: SeDebugPrivilege	1404	svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe
Token: SeDebugPrivilege	2172	svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe
Token: SeDebugPrivilege	5972	svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 228	840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 228 wrote to memory of 2956	228	cmd.exe	97
PID 840 wrote to memory of 1996	840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 1996 wrote to memory of 4792	1996	cmd.exe	101
PID 840 wrote to memory of 696	840	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	102
PID 696 wrote to memory of 1316	696	cmd.exe	105
PID 4732 wrote to memory of 2224	4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe	108
PID 2224 wrote to memory of 4448	2224	cmd.exe	110
PID 4732 wrote to memory of 1712	4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe	112
PID 1712 wrote to memory of 4396	1712	cmd.exe	115
PID 4732 wrote to memory of 3012	4732	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe	116
PID 3012 wrote to memory of 512	3012	cmd.exe	118
PID 1044 wrote to memory of 1520	1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe	120
PID 1520 wrote to memory of 4328	1520	cmd.exe	122
PID 1044 wrote to memory of 4872	1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe	123
PID 4872 wrote to memory of 2780	4872	cmd.exe	125
PID 1044 wrote to memory of 4736	1044	svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe	126
PID 4736 wrote to memory of 3696	4736	cmd.exe	128
PID 1932 wrote to memory of 1588	1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe	130
PID 1588 wrote to memory of 4552	1588	cmd.exe	132
PID 1932 wrote to memory of 3204	1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe	133
PID 3204 wrote to memory of 3756	3204	cmd.exe	135
PID 1932 wrote to memory of 2456	1932	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe	136
PID 2456 wrote to memory of 4996	2456	cmd.exe	139
PID 5064 wrote to memory of 3556	5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe	141
PID 3556 wrote to memory of 2408	3556	cmd.exe	143
PID 5064 wrote to memory of 624	5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe	144
PID 624 wrote to memory of 2136	624	cmd.exe	146
PID 5064 wrote to memory of 820	5064	svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe	147
PID 820 wrote to memory of 3700	820	cmd.exe	149
PID 4424 wrote to memory of 4208	4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe	151
PID 4208 wrote to memory of 2780	4208	cmd.exe	153
PID 4424 wrote to memory of 4420	4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe	154
PID 4420 wrote to memory of 1680	4420	cmd.exe	156
PID 4424 wrote to memory of 3772	4424	svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe	157
PID 3772 wrote to memory of 60	3772	cmd.exe	159
PID 4500 wrote to memory of 2860	4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe	161
PID 2860 wrote to memory of 2920	2860	cmd.exe	163
PID 4500 wrote to memory of 4152	4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe	164
PID 4152 wrote to memory of 3500	4152	cmd.exe	166
PID 4500 wrote to memory of 5044	4500	svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe	167
PID 5044 wrote to memory of 4944	5044	cmd.exe	170
PID 1824 wrote to memory of 2116	1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe	172
PID 2116 wrote to memory of 4192	2116	cmd.exe	174
PID 1824 wrote to memory of 4328	1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe	175
PID 4328 wrote to memory of 3376	4328	cmd.exe	177
PID 1824 wrote to memory of 2908	1824	svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe	178
PID 1036 wrote to memory of 1620	1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe	182
PID 1620 wrote to memory of 1028	1620	cmd.exe	184
PID 1036 wrote to memory of 932	1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe	186
PID 932 wrote to memory of 2036	932	cmd.exe	188
PID 1036 wrote to memory of 3084	1036	svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe	189
PID 3084 wrote to memory of 2392	3084	cmd.exe	191
PID 3520 wrote to memory of 992	3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe	194
PID 992 wrote to memory of 5068	992	cmd.exe	196
PID 3520 wrote to memory of 864	3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe	197
PID 864 wrote to memory of 2988	864	cmd.exe	199
PID 3520 wrote to memory of 4216	3520	svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe	200
PID 4216 wrote to memory of 4236	4216	cmd.exe	202
PID 5032 wrote to memory of 2480	5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe	204
PID 2480 wrote to memory of 2064	2480	cmd.exe	206
PID 5032 wrote to memory of 764	5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe	207
PID 764 wrote to memory of 1700	764	cmd.exe	209
PID 5032 wrote to memory of 3956	5032	svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe	210

C:\Users\Admin\AppData\Local\Temp\2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAAAABCCAAACBCABCCCBBCCBAABBCCBBBBBABCCACBBACAABABACABBBCCCBBACBCACCBBAAACBACACCCACBCBCABABAAACCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAAAABCCAAACBCABCCCBBCCBAABBCCBBBBBABCCACBBACAABABACABBBCCCBBACBCACCBBAAACBACACCCACBCBCABABAAACCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABABACCBBBCCACABCCCBACBBAABCABAABCACBBAABBCCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe" start= auto displayName= "UserDataSvc_CABABABACCBBBCCACABCCCBACBBAABCABAABCACBBAABBCCBCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABABABACCBBBCCACABCCCBACBBAABCABAABCACBBAABBCCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe" start= auto displayName= "UserDataSvc_CABABABACCBBBCCACABCCCBACBBAABCABAABCACBBAABBCCBCAB"
    3⤵
    - Launches sc.exe
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABABACCBBBCCACABCCCBACBBAABCABAABCACBBAABBCCBCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABABABACCBBBCCACABCCCBACBBAABCABAABCACBBAABBCCBCAB"
    3⤵
    - Launches sc.exe
    PID:1316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAACCACCAABBBCCACCBBBBCCBBCCACBBABACAACBBCBCCBAACBACCABABCCCCACCACBCBBCACBAACACCABBABCACBAABAACBABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAACCACCAABBBCCACCBBBBCCBBCCACBBABACAACBBCBCCBAACBACCABABCCCCACCACBCBBCACBAACACCABBABCACBAABAACBABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCCBACCCABBAAAABBBAABCBCCBCBABACCABBCABBCCCAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe" start= auto displayName= "UserDataSvc_BAABCCBACCCABBAAAABBBAABCBCCBCBABACCABBCABBCCCAABCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCCBACCCABBAAAABBBAABCBCCBCBABACCABBCABBCCCAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe" start= auto displayName= "UserDataSvc_BAABCCBACCCABBAAAABBBAABCBCCBCBABACCABBCABBCCCAABCB"
    3⤵
    - Launches sc.exe
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCCBACCCABBAAAABBBAABCBCCBCBABACCABBCABBCCCAABCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCCBACCCABBAAAABBBAABCBCCBCBABACCABBCABBCCCAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCCCBABBCCBBCCACACCABCBBBBAABCBCBBBACCABCACBCCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCCCBABBCCBBCCACACCABCBBBBAABCBCBBBACCABCACBCCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCABBAACBAAAAABBBBCACACABAABCCCAAACACCBCABACCACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe" start= auto displayName= "UserDataSvc_BCCABBAACBAAAAABBBBCACACABAABCCCAAACACCBCABACCACABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCABBAACBAAAAABBBBCACACABAABCCCAAACACCBCABACCACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe" start= auto displayName= "UserDataSvc_BCCABBAACBAAAAABBBBCACACABAABCCCAAACACCBCABACCACABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCABBAACBAAAAABBBBCACACABAABCCCAAACACCBCABACCACABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCABBAACBAAAAABBBBCACACABAABCCCAAACACCBCABACCACABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBCCACABCBCACABBBBABBCCACACCCBCAAAAABBACBABCAAAACBBCABBBCCACBBABACCCCCCABCCAAABCABABABCBCBABBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBCCACABCBCACABBBBABBCCACACCCBCAAAAABBACBABCAAAACBBCABBBCCACBBABACCCCCCABCCAAABCABABABCBCBABBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACBBBBAABCBBBBBCCBBBABAABCACCBBBCCACCACCCCBCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe" start= auto displayName= "UserDataSvc_BBAACBBBBAABCBBBBBCCBBBABAABCACCBBBCCACCACCCCBCACAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACBBBBAABCBBBBBCCBBBABAABCACCBBBCCACCACCCCBCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe" start= auto displayName= "UserDataSvc_BBAACBBBBAABCBBBBBCCBBBABAABCACCBBBCCACCACCCCBCACAB"
    3⤵
    - Launches sc.exe
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACBBBBAABCBBBBBCCBBBABAABCACCBBBCCACCACCCCBCACAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACBBBBAABCBBBBBCCBBBABAABCACCBBBCCACCACCCCBCACAB"
    3⤵
    - Launches sc.exe
    PID:4944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACACABAACCBCAACBACBBCCBBBBBABBCBCCABCACBBACABACACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCBAACBCBCBABAACABBABCCBABACCCAAAABAAAABAAABACABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCBAACBCBCBABAACABBABCCBABACCCAAAABAAAABAAABACABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBAAACBCAABCCBCBCBCCCBBACCABAAABBABAACCBCBBABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe" start= auto displayName= "UserDataSvc_CBCBAAACBCAABCCBCBCBCCCBBACCABAAABBABAACCBCBBABBABB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBAAACBCAABCCBCBCBCCCBBACCABAAABBABAACCBCBBABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe" start= auto displayName= "UserDataSvc_CBCBAAACBCAABCCBCBCBCCCBBACCABAAABBABAACCBCBBABBABB"
    3⤵
    - Launches sc.exe
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBAAACBCAABCCBCBCBCCCBBACCABAAABBABAACCBCBBABBABB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBAAACBCAABCCBCBCBCCCBBACCABAAABBABAACCBCBBABBABB"
    3⤵
    - Launches sc.exe
    PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCBAABABACBABBCABACCBABABBAAABAACBAABCBBABBCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABBCCCCCAABAACBAACCBBBCBABCBCBCAABABBABBABBBBCAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABBCCCCCAABAACBAACCBBBCBABCBCBCAABABBABBABBBBCAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABBBCCCAAAACCCCABBAABBBCBAAAABABCBBCBABBCBCAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe" start= auto displayName= "UserDataSvc_BBCABBBCCCAAAACCCCABBAABBBCBAAAABABCBBCBABBCBCAABAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABBBCCCAAAACCCCABBAABBBCBAAAABABCBBCBABBCBCAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe" start= auto displayName= "UserDataSvc_BBCABBBCCCAAAACCCCABBAABBBCBAAAABABCBBCBABBCBCAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABBBCCCAAAACCCCABBAABBBCBAAAABABCBBCBABBCBCAABAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABBBCCCAAAACCCCABBAABBBCBAAAABABCBBCBABBCBCAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:60

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBABAACCAACACCAABCABAAACAABBAACBCBBBAABBCCACBBBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCCCCBACACBAAACABBCAACBACBCACBBCABBCCCCBBCAABAACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCCCCBACACBAAACABBCAACBACBCACBBCABBCCCCBBCAABAACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCCABBBAACBCACABACCBBBBAACABCACCBACCACCBBCACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe" start= auto displayName= "UserDataSvc_CBCBCCABBBAACBCACABACCBBBBAACABCACCBACCACCBBCACAACB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCCABBBAACBCACABACCBBBBAACABCACCBACCACCBBCACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe" start= auto displayName= "UserDataSvc_CBCBCCABBBAACBCACABACCBBBBAACABCACCBACCACCBBCACAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCCABBBAACBCACABACCBBBBAACABCACCBACCACCBBCACAACB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCCABBBAACBCACABACCBBBBAACABCACCBACCACCBBCACAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACCBCCBBBABBABBCBCCCBCCCCBBBACACCBCBBCBBCCBACBCBCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCBCBABCBCBCCABBBACBCBACCCCBACBCBBBBBBBBBAAABBCBABBCCBAACCBCACCBBACACCCCBCCABBCBAABACACBBAACBBCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCBCBABCBCBCCABBBACBCBACCCCBACBCBBBBBBBBBAAABBCBABBCCBAACCBCACCBBACACCCCBCCABBCBAABACACBBAACBBCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCBBACABCAABABCAAACCCCAACBBBBABAACBCCABCCCCAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe" start= auto displayName= "UserDataSvc_CAACCBBACABCAABABCAAACCCCAACBBBBABAACBCCABCCCCAAABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACCBBACABCAABABCAAACCCCAACBBBBABAACBCCABCCCCAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe" start= auto displayName= "UserDataSvc_CAACCBBACABCAABABCAAACCCCAACBBBBABAACBCCABCCCCAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCBBACABCAABABCAAACCCCAACBBBBABAACBCCABCCCCAAABC"
  2⤵
  PID:2908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACCBBACABCAABABCAAACCCCAACBBBBABAACBCCABCCCCAAABC"
    3⤵
    - Launches sc.exe
    PID:1768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACBACBCAABCCCBBBCCACBBBACABBCCBBABCBCCBBBBABBBCBAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCAABAACBABCBACBCCBCACBACBCAABCBACCABACBCBABCABAAABAACABABCBABBAABCCBABABAAAABCACABABBCBCCBBABBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCAABAACBABCBACBCCBCACBACBCAABCBACCABACBCBABCABAAABAACABABCBABBAABCCBABABAAAABCACABABBCBCCBBABBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAABBABCBAACCAACABAACACACCCCCABAACBBBABBBCACCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe" start= auto displayName= "UserDataSvc_AACAABBABCBAACCAACABAACACACCCCCABAACBBBABBBCACCCBAA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAABBABCBAACCAACABAACACACCCCCABAACBBBABBBCACCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe" start= auto displayName= "UserDataSvc_AACAABBABCBAACCAACABAACACACCCCCABAACBBBABBBCACCCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAABBABCBAACCAACABAACACACCCCCABAACBBBABBBCACCCBAA"
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAABBABCBAACCAACABAACACACCCCCABAACBBBABBBCACCCBAA"
    3⤵
    - Launches sc.exe
    PID:1016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBAAACCBCAABABAAACBBCCCBCCBABABAABABBABABBAAABBBBCAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAABBACBBCABAABCCBBACACAACBACAACACABABAAACAACCABBACCAACBCCCABBAABBCBBABABACACAACCBAACACACBAABBCAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAABBACBBCABAABCCBBACACAACBACAACACABABAAACAACCABBACCAACBCCCABBAABBCBBABABACACAACCBAACACACBAABBCAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAABCBCABCBCABBCBBCABCCBBBABCACBCACAABACBBABBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe" start= auto displayName= "UserDataSvc_CAAAABCBCABCBCABBCBBCABCCBBBABCACBCACAABACBBABBBABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAABCBCABCBCABBCBBCABCCBBBABCACBCACAABACBBABBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe" start= auto displayName= "UserDataSvc_CAAAABCBCABCBCABBCBBCABCCBBBABCACBCACAABACBBABBBABC"
    3⤵
    - Launches sc.exe
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAABCBCABCBCABBCBBCABCCBBBABCACBCACAABACBBABBBABC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAABCBCABCBCABBCBBCABCCBBBABCACBCACAABACBBABBBABC"
    3⤵
    - Launches sc.exe
    PID:2392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACCACBBABCACBCABBBBABCCABCCABBBBAACBCBCBAACABCABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBCCABCCCBCABBBABCCAAAACBACCABCCBCBAACBBBBAAAAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBCCABCCCBCABBBABCCAAAACBACCABCCBCBAACBBBBAAAAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCABCABACACAABCACBABBBAABBCACCACBBCBBBCCBCAACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe" start= auto displayName= "UserDataSvc_BBBCABCABACACAABCACBABBBAABBCACCACBBCBBBCCBCAACCAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCABCABACACAABCACBABBBAABBCACCACBBCBBBCCBCAACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe" start= auto displayName= "UserDataSvc_BBBCABCABACACAABCACBABBBAABBCACCACBBCBBBCCBCAACCAAC"
    3⤵
    - Launches sc.exe
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCABCABACACAABCACBABBBAABBCACCACBBCBBBCCBCAACCAAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCABCABACACAABCACBABBBAABBCACCACBBCBBBCCBCAACCAAC"
    3⤵
    - Launches sc.exe
    PID:4236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBCACBCAACCBACABAAACCBCCABCBACCCBBAAAAACABAABCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAABBBABBCBCBCAABCABACABBABAACCACBBCACCBBCABABAABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAABBBABBCBCBCAABCABACABBABAACCACBBCACCBBCABABAABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAABBABCCCCCAABBBACACBAACBAAABBBCABABBACBCCCBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe" start= auto displayName= "UserDataSvc_BBAAABBABCCCCCAABBBACACBAACBAAABBBCABABBACBCCCBCAAA"
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAABBABCCCCCAABBBACACBAACBAAABBBCABABBACBCCCBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe" start= auto displayName= "UserDataSvc_BBAAABBABCCCCCAABBBACACBAACBAAABBBCABABBACBCCCBCAAA"
    3⤵
    - Launches sc.exe
    PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAABBABCCCCCAABBBACACBAACBAAABBBCABABBACBCCCBCAAA"
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAABBABCCCCCAABBBACACBAACBAAABBBCABABBACBCCCBCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCCABCACBBCBBBBAAABCBCBCCCCACBCAACABBCBBAABACAAABBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACBCCCBBACCABAABABCBBCBBBACABABBBCCBABCCACACABCACAABBABBCACCCCBABBACCCACCCBCBABACCAAABBACBBCBABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACBCCCBBACCABAABABCBBCBBBACABABBBCCBABCCACACABCACAABBABBCACCCCBABBACCCACCCBCBABACCAAABBACBBCBABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAAACBACACBABCBBCBAABABCCAABBCBAAAAACABCCAABBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe" start= auto displayName= "UserDataSvc_ACCAAACBACACBABCBBCBAABABCCAABBCBAAAAACABCCAABBCCAB"
  2⤵
  PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAAACBACACBABCBBCBAABABCCAABBCBAAAAACABCCAABBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe" start= auto displayName= "UserDataSvc_ACCAAACBACACBABCBBCBAABABCCAABBCBAAAAACABCCAABBCCAB"
    3⤵
    - Launches sc.exe
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAAACBACACBABCBBCBAABABCCAABBCBAAAAACABCCAABBCCAB"
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAAACBACACBABCBBCBAABABCCAABBCBAAAAACABCCAABBCCAB"
    3⤵
    - Launches sc.exe
    PID:5060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACCCABCABBACACBABBACCAABBAAACCCAAACCACABCBCCBCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBACCCBAABBCAACABBCCCAACBAAABCACCAAACBCCBCABBBBBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBACCCBAABBCAACABBCCCAACBAAABCACCAAACBCCBCABBBBBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBAABCBBBBBCBACBBCACABBAACABBCBCACBBABBABABACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe" start= auto displayName= "UserDataSvc_BACBBAABCBBBBBCBACBBCACABBAACABBCBCACBBABBABABACBAC"
  2⤵
  PID:224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBAABCBBBBBCBACBBCACABBAACABBCBCACBBABBABABACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe" start= auto displayName= "UserDataSvc_BACBBAABCBBBBBCBACBBCACABBAACABBCBCACBBABBABABACBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBAABCBBBBBCBACBBCACABBAACABBCBCACBBABBABABACBAC"
  2⤵
  PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBAABCBBBBBCBACBBCACABBAACABBCBCACBBABBABABACBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBCABCCCABCBBACBBCACCCAAACAACCCABBBCABCCBBBACCBAAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBCBAABBBAABCACCBBCBCCCCCAABBCAAABBBBABBBBBCCBACCBBCABCBABBAABBBBAACBCCBBCCBCACCBCCACBCBBCAAAABBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBCBAABBBAABCACCBBCBCCCCCAABBCAAABBBBABBBBBCCBACCBBCABCBABBAABBBBAACBCCBBCCBCACCBCCACBCBBCAAAABBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBACCACACBBBBBBBCBACBCACACACCCBCACABBBAABBABACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe" start= auto displayName= "UserDataSvc_BCCBACCACACBBBBBBBCBACBCACACACCCBCACABBBAABBABACCBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBACCACACBBBBBBBCBACBCACACACCCBCACABBBAABBABACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe" start= auto displayName= "UserDataSvc_BCCBACCACACBBBBBBBCBACBCACACACCCBCACABBBAABBABACCBB"
    3⤵
    - Launches sc.exe
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBACCACACBBBBBBBCBACBCACACACCCBCACABBBAABBABACCBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBACCACACBBBBBBBCBACBCACACACCCBCACABBBAABBABACCBB"
    3⤵
    - Launches sc.exe
    PID:3664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBACBAABAABABBBCBCBABCCAABABBABBABABBBBABABCACBBCCCCCABAABABCCCCAACCBBCCBABAABAACBABCABAABCCACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBACBAABAABABBBCBCBABCCAABABBABBABABBBBABABCACBBCCCCCABAABABCCCCAACCBBCCBABAABAACBABCABAABCCACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBBCBBAAABBCCCCAABCBCBBACAABBCCBBCBBAACABBACBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe" start= auto displayName= "UserDataSvc_CCBBBBCBBAAABBCCCCAABCBCBBACAABBCCBBCBBAACABBACBAAC"
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBBCBBAAABBCCCCAABCBCBBACAABBCCBBCBBAACABBACBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe" start= auto displayName= "UserDataSvc_CCBBBBCBBAAABBCCCCAABCBCBBACAABBCCBBCBBAACABBACBAAC"
    3⤵
    - Launches sc.exe
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBBCBBAAABBCCCCAABCBCBBACAABBCCBBCBBAACABBACBAAC"
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBBCBBAAABBCCCCAABCBCBBACAABBCCBBCBBAACABBACBAAC"
    3⤵
    - Launches sc.exe
    PID:2348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBCCABBBBABACAACCCBBCBBBABBAAABBACBABACBCCCCABCCBBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCBBBACACBCBAABBCACBBBBACAABAAACAACBACABCCBACAABCACCBABAAACBBCBBACCCABABBCBCACBACABCBACBAAAACABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCBBBACACBCBAABBCACBBBBACAABAAACAACBACABCCBACAABCACCBABAAACBBCBBACCCABABBCBCACBACABCBACBAAAACABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACAACCCBAAABBBBCAACACBACAACCCABBAABBBCCCCAAAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe" start= auto displayName= "UserDataSvc_BBAACAACCCBAAABBBBCAACACBACAACCCABBAABBBCCCCAAAACCB"
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACAACCCBAAABBBBCAACACBACAACCCABBAABBBCCCCAAAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe" start= auto displayName= "UserDataSvc_BBAACAACCCBAAABBBBCAACACBACAACCCABBAABBBCCCCAAAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACAACCCBAAABBBBCAACACBACAACCCABBAABBBCCCCAAAACCB"
  2⤵
  PID:664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACAACCCBAAABBBBCAACACBACAACCCABBAABBBCCCCAAAACCB"
    3⤵
    - Launches sc.exe
    PID:3404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBACACABCABBABCBCABAAACCCCBABCCCCBCABBBCCABCABCBAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABAABAACCACBACACBBCBCAABCABABABBCBCCBAAABAACBBCBAABCABBCABAAAACBACBACCBABABCBBCACCBBABBCACCBCBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABAABAACCACBACACBBCBCAABCABABABBCBCCBAAABAACBBCBAABCABBCABAAAACBACBACCBABABCBBCACCBBABBCACCBCBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBBCCCABABACCBCABCAACABBCBCCBABACBABCCBCACCBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe" start= auto displayName= "UserDataSvc_CABCBBCCCABABACCBCABCAACABBCBCCBABACBABCCBCACCBBBAA"
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBBCCCABABACCBCABCAACABBCBCCBABACBABCCBCACCBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe" start= auto displayName= "UserDataSvc_CABCBBCCCABABACCBCABCAACABBCBCCBABACBABCCBCACCBBBAA"
    3⤵
    - Launches sc.exe
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBBCCCABABACCBCABCAACABBCBCCBABACBABCCBCACCBBBAA"
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBBCCCABABACCBCABCAACABBCBCCBABACBABCCBCACCBBBAA"
    3⤵
    - Launches sc.exe
    PID:4512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCACBBCCAAABCCBABCCACBCBBBBABAAACCCBCBACBBAAAAAAAAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABACCBAACBCACCBABABACBBACBBAACBBBCCCABCABACBBAABBAABACBCABBABABABACBCBAAACACABBBABAACCBBCBCAACACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABACCBAACBCACCBABABACBBACBBAACBBBCCCABCABACBBAABBAABACBCABBABABABACBCBAAACACABBBABAACCBBCBCAACACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBACACCBCCABABCBCBCABACACBBCABACCAABBCBAACACCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe" start= auto displayName= "UserDataSvc_AABBACACCBCCABABCBCBCABACACBBCABACCAABBCBAACACCACAC"
  2⤵
  PID:4468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBACACCBCCABABCBCBCABACACBBCABACCAABBCBAACACCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe" start= auto displayName= "UserDataSvc_AABBACACCBCCABABCBCBCABACACBBCABACCAABBCBAACACCACAC"
    3⤵
    - Launches sc.exe
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBACACCBCCABABCBCBCABACACBBCABACCAABBCBAACACCACAC"
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBACACCBCCABABCBCBCABACACBBCABACCAABBCBAACACCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABAACCBACACBBCBBBCBABABBACCBCCBBBAABCCCACBCBBACCBCBBCCBACCAABBBBCCCABCCAAACABBCBBBBBCBBCBBABACBCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABAACCBACACBBCBBBCBABABBACCBCCBBBAABCCCACBCBBACCBCBBCCBACCAABBBBCCCABCCAAACABBCBBBBBCBBCBBABACBCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAACCAACABACBBBCBBCCBBBBBCCBBCBACCCBBACCACABCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe" start= auto displayName= "UserDataSvc_AAAACCAACABACBBBCBBCCBBBBBCCBBCBACCCBBACCACABCBAACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAACCAACABACBBBCBBCCBBBBBCCBBCBACCCBBACCACABCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe" start= auto displayName= "UserDataSvc_AAAACCAACABACBBBCBBCCBBBBBCCBBCBACCCBBACCACABCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAACCAACABACBBBCBBCCBBBBBCCBBCBACCCBBACCACABCBAACB"
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAACCAACABACBBBCBBCCBBBBBCCBBCBACCCBBACCACABCBAACB"
    3⤵
    - Launches sc.exe
    PID:1392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACACCAABACCBAABBABCCBAABCCABACCBCCAABAACAAAAAACAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAABCCBACCACAACABABABABACBCACCCABBBCBABCBBBAABACCCAABCBBCBAABACABAAABAACBCAABBAABBCBCAABCBAABBCCACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAABCCBACCACAACABABABABACBCACCCABBBCBABCBBBAABACCCAABCBBCBAABACABAAABAACBCAABBAABBCBCAABCBAABBCCACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABAAABACCBCCABCBBBABCAAAACBCABBABBCCCBABBBCCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe" start= auto displayName= "UserDataSvc_ABBABAAABACCBCCABCBBBABCAAAACBCABBABBCCCBABBBCCCCCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABAAABACCBCCABCBBBABCAAAACBCABBABBCCCBABBBCCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe" start= auto displayName= "UserDataSvc_ABBABAAABACCBCCABCBBBABCAAAACBCABBABBCCCBABBBCCCCCB"
    3⤵
    - Launches sc.exe
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABAAABACCBCCABCBBBABCAAAACBCABBABBCCCBABBBCCCCCB"
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABAAABACCBCCABCBBBABCAAAACBCABBABBCCCBABBBCCCCCB"
    3⤵
    - Launches sc.exe
    PID:804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABBCABAAABAABBBACAABCCBCACBACBABBBAACACAAABAABBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBCCCAABACCBCCBBCAACBCCACBBABABACBBCCABBBCBABACBCBBAAAAACACABCCACCACCCAABCABCAACBBBCCBABBCACCACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBCCCAABACCBCCBBCAACBCCACBBABABACBBCCABBBCBABACBCBBAAAAACACABCCACCACCCAABCABCAACBBBCCBABBCACCACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBABAAACAAABAACAAABACCCCBCACBBBAABAACBAAACBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe" start= auto displayName= "UserDataSvc_ABBCBABAAACAAABAACAAABACCCCBCACBBBAABAACBAAACBBCBCC"
  2⤵
  PID:860
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCBABAAACAAABAACAAABACCCCBCACBBBAABAACBAAACBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe" start= auto displayName= "UserDataSvc_ABBCBABAAACAAABAACAAABACCCCBCACBBBAABAACBAAACBBCBCC"
    3⤵
    - Launches sc.exe
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBABAAACAAABAACAAABACCCCBCACBBBAABAACBAAACBBCBCC"
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCBABAAACAAABAACAAABACCCCBCACBBBAABAACBAAACBBCBCC"
    3⤵
    - Launches sc.exe
    PID:2008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBBABACAABACCBCAAACCABBACCABCCCAACBBBABCACCABBABBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAABBBBBAAAABBBACBCACACAACAAABACBBBCCABAAACCCBBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAABBBBBAAAABBBACBCACACAACAAABACBBBCCABAAACCCBBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBACCAACCAAABABAAABABBBAABBBBBABACCBCBAACACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe" start= auto displayName= "UserDataSvc_CABBBACCAACCAAABABAAABABBBAABBBBBABACCBCBAACACBBBAA"
  2⤵
  PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBACCAACCAAABABAAABABBBAABBBBBABACCBCBAACACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe" start= auto displayName= "UserDataSvc_CABBBACCAACCAAABABAAABABBBAABBBBBABACCBCBAACACBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBACCAACCAAABABAAABABBBAABBBBBABACCBCBAACACBBBAA"
  2⤵
  PID:5548
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBACCAACCAAABABAAABABBBAABBBBBABACCBCBAACACBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAABBCBBBCABBAACAAABBBCCCCABCBAAAAACABBACBACBACCBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACCBBCCCAACCACCBAABABCBABCBCBCACACCACCBBABCCCCBACBBCBABAABCCABCCACBABCCAACBBBAAACCAACCABCBAABCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACCBBCCCAACCACCBAABABCBABCBCBCACACCACCBBABCCCCBACBBCBABAABCCABCCACBABCCAACBBBAAACCAACCABCBAABCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCACCAACCBCAAACABCAABACCCBBCBACCABCABCAACCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe" start= auto displayName= "UserDataSvc_AACACCACCAACCBCAAACABCAABACCCBBCBACCABCABCAACCCAABC"
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACCACCAACCBCAAACABCAABACCCBBCBACCABCABCAACCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe" start= auto displayName= "UserDataSvc_AACACCACCAACCBCAAACABCAABACCCBBCBACCABCABCAACCCAABC"
    3⤵
    - Launches sc.exe
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCACCAACCBCAAACABCAABACCCBBCBACCABCABCAACCCAABC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACCACCAACCBCAAACABCAABACCCBBCBACCABCABCAACCCAABC"
    3⤵
    - Launches sc.exe
    PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABACAABABBBBBACCCBBBCCCBACBBBCBABCAABACABBACAACAACCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBBBABAACBBAAAAABCAAACBCBBACCABBBBABBCACACAABCABAAAACCABCCCAAABABCACBAAABAAAAAABBBAAACAABCBCBCCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBBBABAACBBAAAAABCAAACBCBBACCABBBBABBCACACAABCABAAAACCABCCCAAABABCACBAAABAAAAAABBBAAACAABCBCBCCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBACCCACACBCACCBBBBBBBABBBBCCABAABBBBCAACBBABAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe" start= auto displayName= "UserDataSvc_BCBACCCACACBCACCBBBBBBBABBBBCCABAABBBBCAACBBABAABAC"
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBACCCACACBCACCBBBBBBBABBBBCCABAABBBBCAACBBABAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe" start= auto displayName= "UserDataSvc_BCBACCCACACBCACCBBBBBBBABBBBCCABAABBBBCAACBBABAABAC"
    3⤵
    - Launches sc.exe
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBACCCACACBCACCBBBBBBBABBBBCCABAABBBBCAACBBABAABAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBACCCACACBCACCBBBBBBBABBBBCCABAABBBBCAACBBABAABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCAACBCBCBACBABCCCCABABBACAAACABCBACAAAABBCBCACABCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCABABCCACBCACAAABAAAABCBBBBBCCBBBAABACCBABCACABBACCBCBACBAAABBBBBACBCCBAAACBABACCABBBCBBABCBCBCABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCABABCCACBCACAAABAAAABCBBBBBCCBBBAABACCBABCACABBACCBCBACBAAABBBBBACBCCBAAACBABACCABBBCBBABCBCBCABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBABACCACACABCAAAAABCCCBCABCCCBAAABCBBCBBABCBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe" start= auto displayName= "UserDataSvc_CACBABACCACACABCAAAAABCCCBCABCCCBAAABCBBCBBABCBCCAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBABACCACACABCAAAAABCCCBCABCCCBAAABCBBCBBABCBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe" start= auto displayName= "UserDataSvc_CACBABACCACACABCAAAAABCCCBCABCCCBAAABCBBCBBABCBCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBABACCACACABCAAAAABCCCBCABCCCBAAABCBBCBBABCBCCAC"
  2⤵
  PID:5260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBABACCACACABCAAAAABCCCBCABCCCBAAABCBBCBBABCBCCAC"
    3⤵
    - Launches sc.exe
    PID:5312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBACCCBBCCBBACAABBAABCBAAAACAACAACAABBCBAACCABABCB.exe
1⤵
- Executes dropped EXE
PID:3288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABACCACAAACABCAACCBCCCBBACCACBAAACCCABCBBACBBABCACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBBBAABCBBCAACAAACABCCBCBCABBBCCBBBABBACCABCACABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBBBAABCBBCAACAAACABCCBCBCABBBCCBBBABBACCABCACABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe" start= auto displayName= "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
  2⤵
  PID:5492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe" start= auto displayName= "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
    3⤵
    - Launches sc.exe
    PID:5544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
    3⤵
    - Launches sc.exe
    PID:5620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCCACBBABBBCAAAAACCCBCBCCBBCBCCBCACCCBCCCBCABABCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAABCBABCBAABCBBCCACABBBAAAABAACCAACBCACBBBBCCAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAABCBABCBAABCBBCCACABBBAAAABAACCAACBCACBBBBCCAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAABACCBCABCAACBABAAABCBCCCABBACACAABABBBBBAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe" start= auto displayName= "UserDataSvc_CABCAABACCBCABCAACBABAAABCBCCCABBACACAABABBBBBAAAAB"
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAABACCBCABCAACBABAAABCBCCCABBACACAABABBBBBAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe" start= auto displayName= "UserDataSvc_CABCAABACCBCABCAACBABAAABCBCCCABBACACAABABBBBBAAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAABACCBCABCAACBABAAABCBCCCABBACACAABABBBBBAAAAB"
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAABACCBCABCAACBABAAABCBCCCABBACACAABABBBBBAAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCABBAACCCABAACCACCAABABACBCCCABAABBCABBAAACBACAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCCACBCCBACACACACBCBCBCBBAACAABBBBCBCABBCCBBCACBCCBBABAACCACBBABBBCAAACABCBCAAABCBBABABAABBBBBAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCCACBCCBACACACACBCBCBCBBAACAABBBBCBCABBCCBBCACBCCBBABAACCACBBABBBCAAACABCBCAAABCBBABABAABBBBBAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBBACCBAACABCBBCCBCCCABBAACACCCCCCCBABCAACCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe" start= auto displayName= "UserDataSvc_AACBBBACCBAACABCBBCCBCCCABBAACACCCCCCCBABCAACCAABBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBBBACCBAACABCBBCCBCCCABBAACACCCCCCCBABCAACCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe" start= auto displayName= "UserDataSvc_AACBBBACCBAACABCBBCCBCCCABBAACACCCCCCCBABCAACCAABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBBACCBAACABCBBCCBCCCABBAACACCCCCCCBABCAACCAABBB"
  2⤵
  PID:5872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBBBACCBAACABCBBCCBCCCABBAACACCCCCCCBABCAACCAABBB"
    3⤵
    - Launches sc.exe
    PID:5944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBCBBCAABACCBABABAABCACABABACAACCCAACACCAACCACCBB.exe
1⤵
- Executes dropped EXE
PID:5632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAAAABCBACCBCBABABAAAABCABCCAAABBBACBACCACBAABBBCC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBAAAABBABBCCBABAAACABCABABBBCCBAACBACBBBCCBCAACCBCCCCBCACCACCBCBACACACBAAABCBABBCAAABACACAABBACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAAAABBABBCCBABAAACABCABABBBCCBAACBACBBBCCBCAACCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBAAAABBABBCCBABAAACABCABABBBCCBAACBACBBBCCBCAACCBCCCCBCACCACCBCBACACACBAAABCBABBCAAABACACAABBACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAAAABBABBCCBABAAACABCABABBBCCBAACBACBBBCCBCAACCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAABBCBAACBACBBACCBABCCABBCAAACBCACCCBABABCCBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAAAABBABBCCBABAAACABCABABBBCCBAACBACBBBCCBCAACCBCC.exe" start= auto displayName= "UserDataSvc_BBAAABBCBAACBACBBACCBABCCABBCAAACBCACCCBABABCCBBAAB"
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAABBCBAACBACBBACCBABCCABBCAAACBCACCCBABABCCBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAAAABBABBCCBABAAACABCABABBBCCBAACBACBBBCCBCAACCBCC.exe" start= auto displayName= "UserDataSvc_BBAAABBCBAACBACBBACCBABCCABBCAAACBCACCCBABABCCBBAAB"
    3⤵
    - Launches sc.exe
    PID:5684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAABBCBAACBACBBACCBABCCABBCAAACBCACCCBABABCCBBAAB"
  2⤵
  PID:5700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBBCBBCACCAABBCCCBCBABABBABBCBABCBBACBABBCBBBABAAB.exe
1⤵
- Executes dropped EXE
PID:5220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCBCBBBACCABABBABABACCCCABBAAABCACCBBCCCBABCAAB.exe
1⤵
- Executes dropped EXE
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1e493459d126a7487e9bcc706a82000f3e0dd03305d65dc53569c02eb131e51
MD5 770ceef5e8e0320e39770f12f996f491
SHA1 fab363347c00aa66dd8a7f91721044588f5fd82e
SHA512 f55f62c258947544459a238258e2f1e92a736eb4b35dd3ac73d33255074824a3d452c2b9c6863b059444dab1f699d02c108fc00327f451a07df7792f09f8af5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 50cf61afd6755e579bd63d03957055f1afbf3c6e0d415da32aac5d53f539a78f
MD5 086991ac936996280b1ace3afee29464
SHA1 ea7a9c6f2d2e5d27830743c43b3db57ee790cf31
SHA512 b0148607637b5d35c9e9959442aa9609839b31ea8e4484eb651edf537c425313f0bca3b12cc9691353ca295ae7539d22e6a46149e3660c34aa15c3878aee5f29
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 54909876b831722ca235ae54dcb9c2075d168bd3dc0d7e3327bc8f2a4af55eac
MD5 05e11668cd78a65500f831cd043ab67f
SHA1 821ad3c30f0b6ccdcc72da955732a4df8ec8def5
SHA512 92b73bef5ce2ea8b1cead06971d82870126a3a4851fe34b399d5583c932f0656cf6a9b18126074b8b1cdd15ad38191657f2c08990bb5cc8f79cd99a2692bd82d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9e6a9f356b295e26eb47b2165d8217bbb4cd5bfb573081f815d0a2b78ed09cd7
MD5 04129a82a2514954afa217e8d521959e
SHA1 0b05f298be936c97774ef226f3350ffc312cf01e
SHA512 6a25e431f91b65b6cfa6a606a0fbee8146df6504efc7b6faad03705bcf17b7b5f50316b143f4552da514a01fc6c9d7c4c529629017ccea3bbee471931e2890d3
MD5 SHA1 SHA512

Submit Download

svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABAAAACBBBCAACBAAACAAAAABBBACACCBBBBCCCACACCACABA.exe
Size 12.8MB
SHA256 f857a2b99a4ebd63b0b07afa416f09d48bfdad964bea0f62e15b2f0756fa3c67
MD5 5dcbb1125a348fde6e6190673893000c
SHA1 5c0493a86db68d353aa62c222a6a7d20d425c355
SHA512 8c92f9fa09cbd5f17b59c92f708277edba16dce8ea3c2092a81a37c6d6c8542430aec1317b888f512d42de2f66c2dfcd17a9c9e118dd28ebe03577c1299883b0
SSDEEP 98304:B4TS4TS4TS4TS4TS4TS4TS4T6OU/jIEeQfoR/IuOFVjUu54:BppppppphFIF0wum
TLSH
T13ED67C12B6ED016DF0F30B31EE39A266A935FCFE6E12D55E6549740E2672B00C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 846799ae064bf6ae405be4f8fd58a33c921e6a8f26f8564c295bf97b0bc4a45a
MD5 c17b08d46dff6fc15be5318c0c053252
SHA1 fb77ffdb01e81ca9ea42ff562708281ea25ba8bd
SHA512 000cabd100ce2d3782d5a1be369dd2ed932fe691834a371652f92714ce032a37a39e3e54607223cc21b20385d58a60495fc3cb8490cde609e523d217f65452b0
SSDEEP 96:oHTI1Wax4am7+weyhu27JT6TD1bcVt4VECEP5s+Keiah109f49K/tb+wPCUL19zJ:CI9XyCyhPkx/eDhuWUL3Max
TLSH
T189911921F1A5DC73F23169C7951AEBD149E8F39FAC8C9A1562C94228BF94C338D1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 76c7c23b0a130cd713635ac389019042cfd24611f43805a7ef5efdd8b3caf638
MD5 8492103490528a8c46c1c12e1a562ffe
SHA1 18c8f39bce1e88ae84f85ac516eda18cfe6daf41
SHA512 1e4ef71a7e8104d519aae0c005825935fa9cd8f50842396eab29d6dd0ca4e9f29c85e23b8b7d0e5d827d50ef4a2b1666d153eea73cf1492819213704626185c0
SSDEEP 96:oHTI1Wax4am7+weyhu27JT6TD1bcVt4VECEP5s+Keiah109f49K/tb+wPCUL19zl:CI9XyCyhPkx/eDhuWUL3MaIQDG0
TLSH
T15DA10821F1A5DC73F23169C7951AEBD149E8F39FAC8C9A1562C98628BF94C338D1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 13d824164e8a5c01cbb272d8066299e482a206b1b23c73717ad947b4db0fd278
MD5 3bb24d21af5cafd80d283b9a5bb7b1d7
SHA1 67e64bdf2395d9942206cc2b5a741a2bcc8dc70d
SHA512 05d829a1f007f62becb8413daaa239b0fb1b771d99272a2786aa430494e69d9114df9ed31439aab57b0adc1bc3e117d97eab1888f28b0b84219b14fea1eb185f
SSDEEP 96:oHTI1Wax4am7+weyhu27JT6TD1bcVt4VECEP5s+Keiah109f49K/tb+wPCUL19zj:CI9XyCyhPkx/eDhuWUL3MaIQDGIe8oQr
TLSH
T1CBC1F921F1A5DC73E23159C7961AEBD149E8F39FAC8C5A2552C98228BF94C338D1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 e06bb73ec59e7485f797030dbf914f5dd045b883ce6f7472116ffe419324002f
MD5 9bec0def0c4dca7841b19d4b974c1bbe
SHA1 d491a8451ea816092b26741c205251d04faf5ea0
SHA512 3e6b80b773ac311d1b0ca58946167043fe5e5c3e9f0e4dd902cf491b2e70012bc2b181062bf045d436979a9fcc50c2f1565571c8cff2dc1a1e202367e357ca49
SSDEEP 192:CI9XyCyhPkx/eDhuWUL3MaIQDGIe8oQdC5/Me7YWH2:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Meo
TLSH
T1ADF1F921E1A5DC73F13159C79A26EBD649E8F39BAC8C5A1553C98228BF94C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 0235081d2d540eada4dc4a9794a5e4892b359b357e80daca96221bac7e45dc4c
MD5 7bbcbad40ad07cd1b998daba1e7b8f3e
SHA1 a6c8f552acd71b89a7459edd0662f291cb88430c
SHA512 9fe1246be2ed34b59109a3adfcdb467a0050f39c3084645b3ca48e7bb941eaef0d2473513e5eae71ea6b60664c20559123eed360b48b40b4d84a38dffa1fe8e0
SSDEEP 192:CI9XyCyhPkx/eDhuWUL3MaIQDGIe8oQdC5/Me7YWHO:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Meo
TLSH
T11CF1F921E1A5DC73F13159C79A26EBD649E8F39BAC8C5A2553C98228BF94C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 de4b3c2f1682abb6797d6358735640bd3f868d1124da0d681b6f2830df5ed980
MD5 077450e127e4eddd97a5ef0661b65e35
SHA1 2f57ff51f3cbb16d256705934ac472d267d2d860
SHA512 a8d7657f2dadad86d35e262669dfa72fccf4ce23a261e79e33e9a46899b772f121394882fb6146e82577b58b923a9d6ad851c2685e5acf0877713bed11473f9f
SSDEEP 192:CI9XyCyhPkx/eDhuWUL3MaIQDGIe8oQdC5/Me7YWHsxq3unW86:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1MeJ
TLSH
T19822D821E1A5DC73F13169C79926EBD68DE8F39BAC8C5A2553C94228BF94C338D1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 caa82b630c3ff0ef7fa0fa056eac323471f5a9afe4b8c868437621fca805f75f
MD5 616401e9068bf2a8aa9615f5068dc084
SHA1 af2085c615c1e90411f5fa73860f678cf3a5e4d2
SHA512 56f8fdd72f05ee90594533f846d9df0550abde2f0a5c7b0f6caa0cbf49859a4119302668c78b1b88098f5810c0e5303790c5dadf8826b86953b76c46ac6c251f
SSDEEP 192:CI9XyCyhPkx/eDhuWUL3MaIQDGIe8oQdC5/Me7YWHsxq3unW8Yq9W3:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Mer
TLSH
T12622D821E1A5DC73F13159C79A26EBD64DE8B39BAC8C5A2553C94228BF98C338D1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 6147c290502bd201d59baf350639d47075d2ade20514d542449bca90209e6710
MD5 b7f28f19be13dbc6da362237e513b7e5
SHA1 6d5e54c6ace15370f0a738b3203a6e8bce855258
SHA512 9650cbc53d6706b836361cfb4d6b5e3f906283cc30b646446738d41e8e13c6c167d8cbced21298d9f2ad11130414c1c2a9b4b7b2e90e46abec8768d2ba9e9171
SSDEEP 192:CI9XyCyhPkx/eDhuWUL3MaIQDGIe8oQdC5/Me7YWHsxq3unW8Yq9WGaDfj:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Mex
TLSH
T1C532F921E1A5DC73F13159C79A26EBD64DE8F39BAC8C5A2563C94228BF94C338D1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 5c0e60c09c54c5e801ff3ac627236256329d17144422ff9d71ef392d41236f7c
MD5 754ca5094263612c02329e2d594fe6f9
SHA1 21416336cc2268e2198fd0b720f45cb343cabe57
SHA512 bb7359d825f66b9e50932da6d32ab62724e2451ea430b03cdf7bdea1fa52eef556a60eb5d96891a90d0a92ee5ec8794c5026c7813b6cb78ddeb94f62d8957f36
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJIZ:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+B
TLSH
T1E6420A21E1A5DC73F13159C79A26EBD64DE4B39FAC8C5A1563C94228BF95C338C1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 cd95bfefc3447a6ed0f322588f84b8089fbb3d15b040256ec273ecab97752ee0
MD5 e9d226c090341104625429ea3f595fd7
SHA1 b55bd0f5b47ac6835fb7996647b1665f613f297a
SHA512 42530d22b414b30ee1abba4dc844e59c89f0ed77357a0d10747db1c3498e5b47848d8fe14a06f1b84af19c0bde34fd5a4b4ccbcc6dab489570ce5cf4f01cda5f
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBC:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+0
TLSH
T172520721E1E5DC73E13159C79A2AEBD64DE4B39BBC8C5A2563C94228BF95C338C1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 511aef36ef0c4e9359d518e4e16a79adebbb421cdbd159b916dc8222db145bac
MD5 7d93b4c80e366f54cf6095f976355c4b
SHA1 d33522f49413c27dcddf5a59e18a4e02402ed28c
SHA512 315dcaa8e0a360753a4abb3e5a140d8a1ae35fa11ac753bf9ba649b9895a4046f1b7c951bef0d4d545d18327be07907b64cb57bee171e0ae91b1125f819f41d0
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBW:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+Q
TLSH
T1C8622821E1E5DC73E13159C79A2AEBD68DE4B39BBC8C5A1563C94228BF95C338C1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 4bb36fcc37760506beb395f711db7840e922ef156e77fe307ec9c03a55c8eba5
MD5 dfc765bbba4da79536ddd0a5f69362a9
SHA1 cdaf848fe2edc9f36fcd5f87fa1e8ee4ae73cafc
SHA512 07ba1fc24359dc3123d9816764cff58795c4db76082040ac5991fb5aec0917b39bfd2566134870cfe88ba99072c7adf6adafca66e07f7e6155a38722478d8c8d
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBf:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+B
TLSH
T1E1622821E1E5DC73E13159C79A26EBD68DE4B39BBC8C5A1563C94228BF94C338D1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 ad669a278053d0d17432a06b8fc2b5894704c5b5f57a5e0b264750fbdf89c4b9
MD5 be888b95a1129c4f8c5025a7e2fb7e80
SHA1 637a74e578a8889b23d2dd35eaff535717d83f79
SHA512 36fb7ab515d99062723a7d522067c59df3506370c0036d57638ad6e3cca59344fd0c20ccc7d2b05216fd10d6eed7d817dd7b3115872d5d22a55f3a80c556bdcc
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+p1:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+z
TLSH
T122623821E1E5DC73E13159C79A2AEBD68DE4B39BBC8C5A1563C94228BF94C338C1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 aa520a035ed6d8c05de9a2bb5f89e50e664da1149534dacc6479115fc0e35c2d
MD5 3ecb1325c649a37f1c81cea6b1b1b0e5
SHA1 7de04a6b8f971ce665306dc5f47c4caaf5bb170d
SHA512 894bddecdab807217f2215467c4aeac32907776dd6ab7752332f0598a500869aee992b6c057adc38d5abc20a53b9f4dadce352604a11f21c7a58129db9d93262
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppe:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+a
TLSH
T18D722721E1A5DC73E13159C79A2AEBD64DE4B39BBC8C5A2563C94238BF94C338D1D0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 9139b6066277b3be81f3ab6de5cdca6aad76126a45a5f4025bfb9581198e52ca
MD5 867bf4161f63d3afdf68f2782e21d542
SHA1 3b2752e09f903833f1616d11e49e2a5531802e0a
SHA512 432b2053d7ed09524c35365cf0184e34d5f70531a13f9fbccd984d492fba418c9fdb13efa40078b3aa6e462018f6baa52367f353dad244e1811078d42fa9fc59
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppCJIm:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+Y
TLSH
T179721721E1E5DC73E13259C79A2AEBD64DE4B39BAC8C5A2563C94238BF94C338D1D0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cd6d642bb39fa0699e675ee9176ea224d465cdd23f5731e136a4019d1318f32c
MD5 f39a42c36ca587e79197045459207819
SHA1 6caeb97417df6ef636f141d0ff5135c9be335d10
SHA512 72a2f36231131191191581fbf30aa9343590ca3a02ec6ce0599c6943d357f818a13e642502e856b9b74f4dc1aa51af154dcf6ee2afcc342f2ea439dc5a0288a1
TLSH
T197210821E0A5DC73F23199CAA529EB9148E4B39FEC8C951152CD8728BFA4C37CE0C4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 18KB
SHA256 03157cbd444061668ec7eb751245972a129325cb8d00c97c99b981c3a67cd753
MD5 80f7a1598e4ae7cd28eff41851d4c62d
SHA1 68dad98ed7fcdf5925a8f0e28a068d720cb95c04
SHA512 2a5ac1b89986938ca0e33afe2a175e7cc6b903f7e9303f6c23711ec325ff91c67c6a241f1175b79fcc2b4728f8a459807dfd60436873979f9c62eb28f41643f2
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppCJIT:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+d
TLSH
T162821821E1A5DC73E13269C79A26EBC64DE4B39BBC8C5A1563C94238BF94C338D1D0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 18KB
SHA256 26055571ac9deef9e474bf5d76951b19859cb3ff6e5c6042ca6b0b1473fa3c13
MD5 056668a62b579dde440d8e15ec68d0e0
SHA1 ceb7d8252bb23f03710c7f97e8e23f651677a423
SHA512 596400496e62a6e1d9dbf71dd958f02c523acae7f99d4d2036647bccbe3a20662571a1f2c0bac141f09599b75e0fa5dd43689f32408624a68144d6a60e9070d1
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppCJIly:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+e
TLSH
T1F0821821E1A5DC73E13269C79A2AEBC64DE4B39BBC8C5A1563C94238BF94C338D1D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 18KB
SHA256 14238eb6a706b49731451b0805e779f2c6ec929e52e66467aa7366ed868b499f
MD5 fb72c85f88bcb1e9826c4f9e14249091
SHA1 3640019a9c83a986e7df04dc0b5c3f5144533eed
SHA512 d178106039da0e7747fce86146eccb905dc15ceb0daf699baafd5ec7308ed3f8f3ed092d9e86492fc70d007a035b729ff51940a0af2c85060d04b5c98189678a
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppCJIl5:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+9
TLSH
T1DD921721E1A5DC73E13269C79A2AEBD68DE4B39BBC8C5A1553C94238BF94C338C1D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 19KB
SHA256 0fb86d8249db4ac257fa43d87d35c51baedb0634be75b910280bacedbf4e1b07
MD5 5ab1d5d45316357729725a0362cb40f4
SHA1 506c6c1b94517ffaee5a152e7a88752a3fc47169
SHA512 74d58f2363f766acc00327008081520676f65ea6e0ed203cfdd76b6b982d01ff9fb3ac74aa630c1a14f8e6b6f7d98a7baada13af0523ab783437276e79dfaf32
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppCJIlO:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+q
TLSH
T192921721E1A5DC73E13259C79A2AEBD68DE4B39BBC8C5A1563C94228BF94C338C1D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 19KB
SHA256 290821a8f43bd46d338004b62233ec4d623f95977f7aac3214b1a563e75ec946
MD5 c02e609071c3cb009bf9fb423f61c107
SHA1 5b3690025584a948baa63e8086ebc3c6f06aa60e
SHA512 5e609ce82badbd26f307724ac229cc4f92f6229ec2e16a0591c91ed64c4efdc92f55e2678a0b0e2ec228637d19d8532780d288008b1f9281543a6dd8d425fce2
SSDEEP 384:CIXyCyhPk/eDoWUL8aIQDG/8oQdC1Me7YWHsM+nWtq9WhDfNfJI1nVBq+ppCJIld:CIXyCyJkmDoTL8aIQD+8oaC1Me7dMM+h
TLSH
T1E5920721E1A5DC73E13259C79A2AEFD68DE4B39BBC8C5A1563C94228BF94C338C1D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 849ec0d503a4ac218875d693024d57be8b6b0c10ad567835437598736fa90166
MD5 c30230c1bc6117ac726aeb9e27b3406d
SHA1 8757b1cee87ddc012781274d1fa6a9c30f3029bf
SHA512 415b379a50ff9437dfa1cfc745a17bc220ef286c5919b475d9d87d84713b7377f8ca752221a245334135bd21c84b535ce7692862527478dd7edcfe5fbce2f6ea
TLSH
T103412C21E1A5DC63F1316AC7911AABC148E4B39FAC4C9A1552CE4728BFA4C37CE1D0E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 5a75467cfee0238846ac10cbe345d9f71f70616cf94a88cafefb40bf762f3823
MD5 5f437e76d1896dbcf0c7023fdb6aef30
SHA1 eda45da6d85bbe1f752db9641a525c0b2aa0d029
SHA512 a067a76c08fdb234448df7d6afe4229a325d39494862377752e6f21498c5080c90f8b7d5f984c16e8f88d6c8c8c80be8f9f722d9d6568ad65e4a53de7a35b106
TLSH
T12151FC21E1A5DC63E1315AC7951AEBD148E8B39FEC8C9A1152CD8728BFA4C37CE1D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 954e9b1665f602adfc2f9b49311ce3d9652d3ccb72dc9e2a8d93d407bd786b4c
MD5 f24e610e49c63c0639b13c45658f87fe
SHA1 206bf760829da3dffa916912541a480ae33ec163
SHA512 60c38eb3c07c16f8587b772289c09c2378d4e5ed0df1a35c7cf1c73f27b4082183b0be069e6d818b88fa6e43bf068147ce309338234598b17b8dc87110aef164
TLSH
T12E612A21A1A5DC73F1316AC7911AEBD149E4B39FFC8C9A1552C94628BFA4C37CE1D0E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 a89bebebf8be9dd3de404b239b78ec93d9fcfe9deff8e3aa6b3a90842dc8f21f
MD5 5f9ba030e14b980f90d27d52a10f64f7
SHA1 2212fca341abd5e554259d68f96f0075abeedc9a
SHA512 4257ab84cd9601283b48b30a9bd14793ec29b46236b21be35e2aef8fbc8d6c613c7c993b0399059a71f6b4173d5b27a6a29dc715b0f02e01f78459e4c27d1927
TLSH
T183712931A1A5DC73F23159C7951AEBD148E8B39FEC8C9A1592C94628BFA4C33CD1D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/512-272-0x00000000005E0000-0x0000000000602000-memory.dmp

Download

memory/512-225-0x00000000005E0000-0x0000000000602000-memory.dmp

Download

memory/840-0-0x0000000000580000-0x00000000005A2000-memory.dmp

Download

memory/840-16-0x0000000000580000-0x00000000005A2000-memory.dmp

Download

memory/1036-204-0x0000000000770000-0x0000000000792000-memory.dmp

Download

memory/1044-18-0x0000000000910000-0x0000000000932000-memory.dmp

Download

memory/1044-47-0x0000000000910000-0x0000000000932000-memory.dmp

Download

memory/1404-574-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/1824-165-0x00000000007A0000-0x00000000007C2000-memory.dmp

Download

memory/1824-205-0x00000000007A0000-0x00000000007C2000-memory.dmp

Download

memory/1932-109-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/1932-54-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/2044-534-0x0000000000280000-0x00000000002A2000-memory.dmp

Download

memory/2172-476-0x00000000003F0000-0x0000000000412000-memory.dmp

Download

memory/2692-533-0x0000000000910000-0x0000000000932000-memory.dmp

Download

memory/2828-397-0x0000000000BC0000-0x0000000000BE2000-memory.dmp

Download

memory/2828-462-0x0000000000BC0000-0x0000000000BE2000-memory.dmp

Download

memory/3120-515-0x0000000000780000-0x00000000007A2000-memory.dmp

Download

memory/3120-419-0x0000000000780000-0x00000000007A2000-memory.dmp

Download

memory/3152-573-0x0000000000330000-0x0000000000352000-memory.dmp

Download

memory/3288-567-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/3452-320-0x0000000000040000-0x0000000000062000-memory.dmp

Download

memory/3452-383-0x0000000000040000-0x0000000000062000-memory.dmp

Download

memory/3520-270-0x00000000008E0000-0x0000000000902000-memory.dmp

Download

memory/3520-207-0x00000000008E0000-0x0000000000902000-memory.dmp

Download

memory/3960-341-0x0000000000F40000-0x0000000000F62000-memory.dmp

Download

memory/3960-271-0x0000000000F40000-0x0000000000F62000-memory.dmp

Download

memory/3968-532-0x0000000000480000-0x00000000004A2000-memory.dmp

Download

memory/3980-387-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/4256-323-0x0000000000350000-0x0000000000372000-memory.dmp

Download

memory/4256-384-0x0000000000350000-0x0000000000372000-memory.dmp

Download

memory/4276-566-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/4288-423-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/4288-516-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/4372-550-0x0000000000E50000-0x0000000000E72000-memory.dmp

Download

memory/4372-463-0x0000000000E50000-0x0000000000E72000-memory.dmp

Download

memory/4424-200-0x0000000000020000-0x0000000000042000-memory.dmp

Download

memory/4424-90-0x0000000000020000-0x0000000000042000-memory.dmp

Download

memory/4500-142-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/4500-53-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/4536-385-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/4644-517-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/4644-424-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/4732-34-0x0000000000910000-0x0000000000932000-memory.dmp

Download

memory/4732-17-0x0000000000910000-0x0000000000932000-memory.dmp

Download

memory/5032-202-0x0000000000170000-0x0000000000192000-memory.dmp

Download

memory/5032-273-0x0000000000170000-0x0000000000192000-memory.dmp

Download

memory/5064-110-0x0000000000DC0000-0x0000000000DE2000-memory.dmp

Download

memory/5324-609-0x0000000000460000-0x0000000000482000-memory.dmp

Download